Standardizes on the estate gobuilder image for every step invoking
the Go toolchain and wires in the shared S3-backed GOCACHEPROG.
- Replace golang:1.25 and almalinux9-gobuilder:20260606 with
gobuilder:0.1.2-alma9 in build/test/pre-commit/release(build)
- Add GOCACHE_* env + AWS creds from org secrets to those steps
- Bump their k8s resource requests/limits for compile+cache overhead
Implement a generic Vault/OpenBao secrets engine that issues short-lived
signed JWTs for self-made services, replacing per-app static bearer
Secrets. Per-app roles set the audience, TTLs, subject allowlist and
custom claims; creds/<role> mints an EdDSA (or RS256) token. Apps
validate offline against the unauthenticated JWKS + OIDC-metadata paths,
so there is no Vault round-trip per request. Signing keys are seal-wrapped
in the barrier and rotate with a configurable JWKS grace window.
Mirrors the other vault-plugin-secrets-* engines: cmd ServeMultiplex,
Makefile with patch|minor|major tags, .woodpecker CI (k8s resources + SA),
dual-flavour nfpm RPM to artifactapi rpm-internal. Tests (-race) cover
issuance+JWKS validation for both algorithms, rotation grace/trim, role
isolation, subject allowlist and the unauthenticated/seal-wrap wiring.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkin-agent
benvin
unkinben
gitadmin